Board and Senior Management in Internal Control

The focus of internal control testing is on control activities. The development of controls, policies and procedures, as well as, the ongoing execution of those controls is the focus of management and auditors. The PCAOB has reinforced this focus with pushing for more documentation on management review controls and information provided by the entity to the auditor.

All those controls are important, but without an appropriate control environment and risk assessment foundation, the likelihood of a control failure increases significantly. It is also at the control environment and risk assessment level that the Board and Senior Management play the most significant role in the internal control structure.

The Board and Senior Management must set the values, philosophy and operating style for the organization. In its purest form, they set up the expected standards of conduct and show them in what they do every day. Inherent in setting the operating style is determining the amount of risk the organization is capable and willing to take in in pursuit of its business goals.

Another aspect of key Board and Senior Management guidance is identifying and determining how to react to significant changes occurring in the business, the regulatory environment and in leadership of the entity itself. Finally, the commitment to competence is more than just platitudes about having the best employees. You must back up the words with actions such as developing (training) employees, paying to obtain and keep employees with key skills and certifications, and developing plans for succession, especially around key internal control areas.

If you would like to hear more on this subject, check out my AICPA webcast on December 11 at 12:00 CST. You can get more information on the webcast here.